Vulnerability in Stunnel
CVE-2014-0016
stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the same process ID to use the same entropy pool and allows remote attackers to obtain private keys for EC (ECDSA) or DSA certificates.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.022 (81.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 82nd percentile — 81.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.022 · newest: 0.022 · change: 0.000
Affected products
- Stunnel — versions 0.1, 1.0, 1.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.stunnel.org/sdf_ChangeLog.html (Release Notes, Vendor Advisory)
- bugzilla.redhat.com/attachment.cgi (Patch)
- www.openwall.com/lists/oss-security/2014/03/05/1 (mailing-list, Mailing List, Third Party Advisory)
- bugzilla.redhat.com/show_bug.cgi (VDB Entry, Third Party Advisory, Issue Tracking)
- www.securityfocus.com/bid/65964 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2014-0016?
- CVE-2014-0016 is a vulnerability in Stunnel, classified under CWE-332. Published 2014-03-24.
- Is CVE-2014-0016 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.